CVE-2026-40001

Full vulnerability record from the local CVENow database.

Description

There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.

Severity

MEDIUM

CVSS score

5.2 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-05-06 10:16:19.950000

Last modified

2026-10-26 19:10:00.163000

View original CVE JSON

{
  "id": "CVE-2026-40001",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-06T10:16:19.950",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de escalada de privilegios local en el servicio ZTE PROCESS Guard del cliente de computación en la nube, lo que podría permitir la ejecución de código arbitrario local, escalada de privilegios y el bypass de salto de ruta."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ZTE",
          "product": "ZTE PROCESS Guard service",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "ZXCLOUD-iRAI-ClientV7.2X",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T15:28:46.964380Z",
          "id": "CVE-2026-40001",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1477954674427011121",
      "source": "[email protected]"
    }
  ]
}